3rd-Party Cyber-Risk Mitigation by Using ISO Standards
summary
Claims that adopting ISO 27001 and ISO 22301 produces measurable reductions in third‑party cyber risk by forcing documented supplier agreements, regular supplier audits, and cascading security requirements down vendor tiers. Practical tools described are an ISMS, BCMS, regular risk assessments and Business Impact Analysis, Annex SL high‑level structure for integrated management systems, and a timeline: identify risks in months and implement proactive supplier review within six months. Notes that ISO 31000 and 22316 are guidance only.
AI-written summary · about
chapters (5)
- 0:00Intro
- 8:34ISO 31000:2018 • Risk Management . For organizations of all types and sizes • Managing risk is iterative • The standard and assists organizations in setting strateg achieving objectives and making informed decisions • Guidance document, not certifiable
- 17:31ISO/IEC 27001 - Supplier Relationship Information security requirements for mitigating the risks a with supplier's access to the organization's assets shall be a with the supplier and documented. ► Agreements with suppliers shall include requirements to ad information security risks associated with information and communications technology services and product supply ch Organizations shall regularly monitor, review and audit sup service delivery
- 20:09ISO 22301 Risks addressed in 22301: very generic: "disruption" This standard specifies the structure and requirements a bu continuity management system (BCMS) The outcomes of maintaining a BCMS are shaped by the organization's legal, regulatory, organizational and industry requirements, products and services provided, processes er size and structure of the organization, and the requirement interested parties.
- 25:51DEFINITION ORGANIZATIONAL RESILIENCE Organizational Resilience is the ability and capacity of a corpora withstand potential significant economic / systemic risk or syste discontinuities or business interruption, by adapting or recoveri resisting being affected and resuming its (core) operations to co provide an acceptable level of functioning and structure, A resilient organization is able to adapt and align its strategy, op management systems, governance structure, supply chain, etc, to significantly changing environments.
related talks
44mCybersecurity - Protecting the Organisation's Technological Assets
42mEngineering Trust: Integrating Security into Your Modern SDLC
35mEffective Handling of Third-Party Supplier Incidents
27mSmall Company, Big Threats: Cybersecurity for the Rest of Us
51mThe Overlooked Security Risk: 3rd Party Risk Management
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
42mA Milestone for Open Source Security: How the Brand New ISO 18974 Certification Looks Like and Why the ISO 5230 Supports as a Stepping Stone
36mSupplier Risk Where OSS Collides With Vendor Management